Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am looking for a solution to locate which process are running over 64 and which ones on 32 bits on my Windows Seven 64 system, there is a simple windows shell command available to do that???

share|improve this question

4 Answers 4

up vote 8 down vote accepted

After some thought, I realized the WMIC method is kind of hokey. A much better way to do this is to use a PowerShell script that looks something like this:

[System.Diagnostics.Process[]] $processes64bit = @()
[System.Diagnostics.Process[]] $processes32bit = @()

foreach($process in get-process) {
    $modules = $process.modules
    foreach($module in $modules) {
        $file = [System.IO.Path]::GetFileName($module.FileName).ToLower()
        if($file -eq "wow64.dll") {
            $processes32bit += $process
            break
        }
    }

    if(!($processes32bit -contains $process)) {
        $processes64bit += $process
    }
}

write-host "32-bit Processes:"
$processes32bit | sort-object Name | format-table Name, Id -auto

write-host ""
write-host "64-bit Processes:"
$processes64bit | sort-object Name | format-table Name, Id -auto

If you copy that in to a PowerShell script, call it process-width.ps1, and run it in PowerShell, it will list out all the 32-bit processes followed by the 64-bit processes.

It does this by checking if a process has wow64.dll loaded as a module in to it's process space. wow64.dll is the Windows 32-bit emulation layer for 64-bit operating systems. It will only be loaded by 32-bit processes, so checking for it is a sure-fire way to know if a process is 32-bit or not.

This should work much better as a long term solution.

share|improve this answer
    
It worked too, tyvm –  Diogo May 19 '11 at 11:46
1  
A more succinct way to get all 32-bit processes: Get-Process | where { ($_.Modules | where { $_.FileName -match "\\wow64.dll$" }) } –  Phil Sep 20 '12 at 14:32
wmic process get

Will list out all the processes on the system. You can pass parameters to get which are WMI Win32_Process properties. You can find that list here:

http://msdn.microsoft.com/en-us/library/aa394372(v=vs.85).aspx

One of those may show whether the process is 64 or 32-bit.

e: There isn't a direct property, but you can do:

wmic process get Name, MaximumWorkingSetSize

If the number returned by MaximumWorkingSetSize is greater than 3096, then it's definitely a 64-bit process. On my machine, 64-bit processes will have a MaximumWorkingSetSize of 32768 (aka 32gb), while 32-bit processes will have a MaximumWorkingSetSize of 1380, which is the adjusted size of my swap file. At any rate, the simple check is:

MaximumWorkingSetSize > 3096 == 64-bit
share|improve this answer
    
hmmm something is not working, i used wmic process get > file.txt and found for all entries on it, but on my 64 system it says that I have only 32 processes running. –  Diogo May 18 '11 at 19:32
    
Did you run "wmic process get Name, MaximumWorkingSetSize > file.txt"? If any of those have a MaxiumumWorkingSetSize > 3096, they are 64-bit processes. Also make sure you run as an administrator account so you see all the processes not just yours. –  Matt Holmes May 18 '11 at 19:35
    
Sure, i did it now and it worked, but im still getting a strange result, only dwm.exe and ccSvcHst.exe got more than 1380 score, i was thinking that most of the running process was 64 bits. –  Diogo May 18 '11 at 19:38
    
However it really helped me, thank you very much Matt. –  Diogo May 18 '11 at 19:39
    
Cool, nice trick. –  Jeff F. May 18 '11 at 19:40

It's easy, just fire Task Manager. The process with *32 is 32 bit app

enter image description here

share|improve this answer
    
I think he very clearly wanted this as a shell script, or something he could run and parse the output of. –  Matt Holmes May 18 '11 at 23:52

If you have Visual Studio installed, then you can simply use dumpbin.exe from the Visual Studio Command Prompt to dump the executable headers:

dumpbin.exe /HEADERS file.exe

The machine header will be 14C for an x86 binary and 8664 for x64:

x86:

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
         14C machine (x86)

x64

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES
        8664 machine (x64)
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.